As a data subject of data processing, you have the following rights in particular under the General Data Protection Regulation (hereinafter also referred to as “data subject rights”):

(1) You have the right to request information as to whether or not I process personal data relating to you. If I process your personal data, you have the right to information about

• the purposes of processing;
• the categories of personal data (type of data) that are processed;
• the recipients or categories of recipients to whom your data has been or will be disclosed; this applies in particular if data has been or will be disclosed to recipients in third countries outside the scope of the GDPR;
• the planned storage period, if possible; if it is not possible to specify the storage period, the criteria for determining the storage period (e.g. statutory retention periods or similar) must be communicated;
• their right to rectification and erasure of data concerning them, including the right to restriction of processing and/or the right to object (see also the following sections);
• the existence of a right of appeal to a supervisory authority;
• the origin of the data, if personal data was not collected directly from you.

You are also entitled to information as to whether your personal data is the subject of an automated decision within the meaning of Art. 22 GDPR. Art. 22 GDPR and, if this is the case, what decision-making criteria such an automated decision is based on (logic) or what effects and scope the automated decision may have for you.

If personal data is transferred to a third country outside the scope of the General Data Protection Regulation, you are entitled to information as to whether and, if so, on the basis of which guarantees an adequate level of protection within the meaning of Art. 45, 46 GDPR is ensured at the data recipient in the third country. Art. 45, 46 GDPR is ensured at the data recipient in the third country.

You have the right to request a copy of your personal data. I always provide copies of data in electronic form, unless you have specified otherwise. The first copy is free of charge; a reasonable fee may be charged for further copies. The provision is subject to the rights and freedoms of other persons who may be affected by the transmission of the data copy.

(2) You have the right to demand that I rectify your data if it is incorrect, inaccurate and/or incomplete; the right to rectification includes the right to completion through supplementary declarations or notifications. A correction and/or completion must be made immediately, i.e. without undue delay.

(3) You have the right to demand that I erase your personal data if

• the personal data are no longer necessary for the purposes for which they were collected and processed;
• the data processing is based on your consent and you have withdrawn your consent, unless there is another legal basis for the data processing;
• you have objected to data processing pursuant to Art. 21 GDPR and there are no overriding legitimate grounds for further processing,
• you have objected to data processing for the purpose of direct marketing pursuant to Art. 21 (2) GDPR;
• your personal data has been processed unlawfully;
• it concerns data of a child collected in relation to information society services pursuant to Art. 8 para. 1 GDPR.

There is no right to erasure of personal data if

• the right to freedom of expression and information precludes the request for erasure;
• the processing of personal data is necessary (i) to fulfil a legal obligation (e.g. statutory retention obligations), (ii) for the performance of public tasks and interests in accordance with Union law and/or the law of the Member States (this also includes interests in the area of public health) or (iii) for archiving and/or research purposes;
• the personal data are required for the establishment, exercise or defence of legal claims.

The deletion must take place immediately – i.e. without culpable delay. If personal data has been made public by me (e.g. on the Internet), I must ensure, as far as technically possible and reasonable, that third party data processors are also informed of the deletion request, including the deletion of links, copies and/or replications.

(4) You have the right to restrict the processing of your personal data in the following cases:

• If you have disputed the accuracy of your personal data, you can demand that your data not be used for other purposes for the duration of the accuracy check and be restricted in this respect.
• In the event of unlawful data processing, you can request the restriction of data use in accordance with Art. 18 GDPR instead of data erasure in accordance with Art. 17 para. 1 lit. d GDPR;
• If you need your personal data for the establishment, exercise or defence of legal claims, but your personal data is otherwise no longer required, you can request that I restrict processing to the aforementioned legal prosecution purposes;
• If you have objected to data processing in accordance with Art. 21 (1) GDPR and it is not yet clear whether my interests in processing outweigh your interests, you can request that your data not be used for other purposes for the duration of the review and that it be restricted in this respect.

Personal data whose processing has been restricted at your request may – subject to storage – only be processed (i) with your consent, (ii) for the establishment, exercise or defence of legal claims, (iii) for the protection of the rights of another natural or legal person, or (iv) for reasons of important public interest. If a processing restriction is lifted, you will be informed of this in advance.

(5) Subject to the following provisions, you have the right to demand that the data concerning you be handed over in a commonly used electronic, machine-readable data format. The right to data portability includes the right to transmit the data to another controller; on request, I will therefore – where technically possible – transmit data directly to a controller named or to be named by you. The right to data portability exists only for data provided by you and requires that the processing is based on consent or for the performance of a contract and is carried out by automated means. The right to data portability pursuant to Art. 20 GDPR does not affect the right to data erasure pursuant to Art. 17 GDPR. The data transfer is subject to the rights and freedoms of other persons whose rights may be affected by the data transfer.

(6) In the case of processing of personal data for the performance of tasks carried out in the public interest (Art. 6 para. 1 lit. e GDPR) or to safeguard legitimate interests (Art. 6 para. 1 lit. f GDPR), you can object to the processing of your personal data at any time with effect for the future. In the event of an objection, I must refrain from any further processing of your data for the aforementioned purposes, unless

• there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or
• the processing is necessary for the establishment, exercise or defence of legal claims.

You can object to the use of your data for the purpose of direct advertising at any time with effect for the future; this also applies to profiling insofar as it is associated with direct advertising. In the event of an objection, I must refrain from any further processing of your data for the purpose of direct advertising.

(7) Decisions that have legal consequences for you or significantly affect you may not be based solely on automated processing of personal data, including profiling. This does not apply if the automated

• is necessary for the conclusion or fulfilment of a contract with you,
• is authorised by Union or Member State law, provided that such law contains appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject, or
• with your express consent.

Decisions based solely on automated processing of special categories of personal data are generally not permitted unless Art. 22 para. 4 in conjunction with Art. 9 para. 2 lit. a or g GDPR applies and appropriate measures have been taken to protect the rights and freedoms as well as the legitimate interests of your person.

(8) I will inform you immediately of any data protection violations that may result in a high risk to your personal rights and freedoms; the information may be omitted in cases of Art. 34 para. 3 GDPR. As part of the notification, I will provide you with the following information in particular:

• Description of the data breach,
• Name and contact details of the data protection officer or other contact point for further information,
• Description of the likely consequences of the data breach,
• A description of the measures I have taken or propose to take to address the data breach, including measures to mitigate any adverse effects.

(9) To exercise your rights as a data subject, please contact the office named under § 5. Enquiries that are submitted electronically will generally be answered electronically, unless you have specified otherwise in your enquiry.

The information, notifications and measures to be provided in accordance with the GDPR, including the exercise of data subject rights, are generally provided free of charge. Only in the case of manifestly unfounded or excessive requests am I authorised to charge an appropriate fee for processing or to refrain from taking action (Art. 12 (5) GDPR).

If there are reasonable doubts about your identity, I am entitled to request additional information from you for the purpose of identification, if necessary. If I am unable to identify you, I am entitled to refuse to process your enquiry. I will inform you separately – as far as possible – if I am unable to identify you. (Art. 12 para. 6, Art. 11 GDPR).

As a rule, requests for information will be processed immediately, within one month of receipt of the request. The deadline may be extended by a further two months if this is necessary in view of the complexity and/or number of requests; in the event of an extension of the deadline, I will inform you within one month of receipt of your request, stating the reasons for the delay. If I do not act on a request, I will inform you immediately within one month of receipt of the request, stating the reasons for this and informing you of the possibility of lodging a complaint with a supervisory authority or seeking a judicial remedy . (Art. 12 para. 3 and para. 4 GDPR).

Please note that you can only exercise your rights as a data subject within the framework of any restrictions and limitations provided for by the Union or the Member States. (Art. 23 GDPR).

(10) If I have disclosed personal data to other bodies or recipients, I am obliged, as far as technically possible and reasonable, to notify the recipients of the data of any rectification, erasure and/or restriction of processing. Upon request, I will inform you about the respective recipients of the data.